Audit Manual

Auditing Official Control Delivery Systems in Northern Ireland Contents

1.0 Introduction ..................................................................................................... 4 1.1 Background ............................................................................................... 4 1.2 Purpose ..................................................................................................... 4 1.3 Scope ........................................................................................................ 5 1.4 Principles of the audit system .................................................................... 5 1.5 References to regulatory frameworks, codes and guidance ...................... 6 Local Authorities / District Councils ............................................................ 6 DAERA ...................................................................................................... 7

2.0 Managing the audit function ............................................................................ 8 2.1 Document control....................................................................................... 8 2.2 Independence and independent scrutiny ................................................... 8 Independence ............................................................................................ 8 Independent scrutiny ................................................................................. 8 2.3 Risk based audit programme planning ...................................................... 8 2.4 Auditor ethics and competency .................................................................. 9 Auditor ethics ............................................................................................. 9 Competency: Training and experience ..................................................... 10 Technical auditors and technical experts ................................................ 10 2.5 Co-ordination with other audit systems .................................................... 11 2.6 Complaints process ................................................................................. 11 2.7 Customer satisfaction .............................................................................. 12 2.8 Continuous improvement and lean auditing ............................................. 12 Continuous Improvement ......................................................................... 12 Lean Auditing ........................................................................................... 12 2.9 Audit system management review ........................................................... 15

3.0 The audit engagement process ....................................................................... 16 3.1 Audit engagement planning ..................................................................... 16 Audit plan: scope, objectives and criteria ................................................. 16 Audit team ............................................................................................... 16 Types of audits ........................................................................................ 16 Audit methods .......................................................................................... 16 Audit Evidence ........................................................................................ 17 3.2 Conducting the audit engagement ........................................................... 17 Audit team responsibilities ....................................................................... 17 Working documents .................................................................................. 18 Opening and closing meetings ................................................................. 18 Checklists and aide memoires ................................................................. 18 Auditor notes ............................................................................................ 18 Audit findings ............................................................................................ 19

3.3 Audit reporting ......................................................................................... 19 Individual reports ..................................................................................... 19 Summary reports ...................................................................................... 20 Audit opinions and recommendations ...................................................... 20 Audit Action plans .................................................................................... 22

3.4 Audit follow up ......................................................................................... 22 Timing of follow-up ................................................................................... 22 Evidence of implementation of actions .................................................... 22

Annexe A – FSA In NI Audit System Process ................................................. 23 Annexe B – Independent Scrutiny ................................................................. 24 Annexe C – Risk Based Audit Planning ....................................................... 25 Annexe D – Audit System Management Review Process ............................ 26 Annexe E – Example Of Audit Opinion ....................................................... 27 Annexe F – Glossary .................................................................................... 28

Table 1 – Principles of the audit system ....................................................... 5 Table 2 – Auditor ethics and behaviours ..................................................... 9 Table 3 – Lean principles Applied to auditing ............................................. 13 Table 4 – Practical examples of lean ............................................................ 14 Table 5 – Timing for reporting on an audit .................................................. 19 Table 6 – Categories used for auditor opinion .......................................... 20 Table 7 – Priority rating for auditor recommendations ............................... 21 Table 8 - Topics / areas to be discussed during each management review .... 26 Table 9 – Evidence required for each audit system management review ....... 26 1.0 Introduction

1.1 Background

1.1.1 The primary purpose of Food Standards Agency (FSA) audits(^1) of competent authorities (CAs) is to provide assurance that the delivery of official controls for feed and food is compliant with UK legal requirements and official guidance.

1.1.2 These audits are also designed to verify the effective implementation of planned arrangements and to assess whether the planned arrangements are suitable to achieve the objectives of the relevant legal requirements and guidance.

1.1.3 In Northern Ireland (NI) for the purposes of food and feed, CAs include, FSA, District Councils (DCs) and the Department of Agriculture, Environment and Rural Affairs (DAERA).

1.1.4 The FSA in NI audit system is operated by an audit team which comprises a full-time audit manager and part-time technical auditors selected from policy teams within the FSA in NI or the FSA’s Audit and Assurance team.

1.2 Purpose

1.2.1 The FSA recognises the competent authorities it audits are committed to providing a quality service to the public and food business operators (FBOs). The purpose of this audit manual is to demonstrate the FSA shares this commitment and endeavours to continually improve how the audit function in NI delivers consistently high levels of quality in the context of changing regulatory requirements and official control delivery landscape and expectations.

1.2.2 This audit manual documents the principles and processes used in the FSA in NI audit system(^2) to plan, carry out, report and followed up on the delivery system for feed and food official controls in NI. A flow chart summarising the NI audit system can be found in Annexe A.

1.2.3 It also provides principles and policy information on:

- Independence
- Auditor ethics and competency
- Risk based planning
- Independent scrutiny
- Customer satisfaction
- Continuous improvement and lean

______________________________________________________________________

(^1) ‘audit’ means a systematic and independent examination to determine whether activities and the related results of such activities comply with planned arrangements and whether these arrangements are applied effectively and are suitable to achieve the objectives.

(^2) References to the audit system and the audit team in this manual refer specifically to the system and team in Northern Ireland. • Audit system management review

1.3 Scope

1.3.1 This audit manual, the policies, processes and procedures referenced in it, are applicable to FSA audits of the delivery of official controls by CAs in Northern Ireland.

1.4 Principles of the audit system

1.4.1 The following are the principles setting out how the audit system will conduct its activities.

Table 1 – Principles of the audit system

| Principle | |-----------| | 1. All audit programmes must be selected based on a documented risk prioritisation process which clearly records and disseminates prioritisations to stakeholders, on an annual basis. | | 2. Before the commencement of any audit programme a clearly defined audit plan must be provided to and agreed with the competent authority (auditee). | | 3. Every audit programme plan must ensure the audit team is resourced with the appropriate/specific technical competency to achieve the objectives of the audit programme. | | 4. Every audit programme must include clear objectives and the audit team must be able to demonstrate these objectives have been met at the end of the audit programme. | | 5. The audit team will apply and practice progressive auditing techniques, such as lean methodologies and continuous improvement principles, to all areas of the audit system. | | 6. The audit team will be proactive in providing clarity to competent authorities including, communication before, feedback during and feedback after all audit engagements. | | 7. Each CA will be provided with a written report of the audit engagement. They will be given the opportunity to comment on the report before it is finalised. | 8. CAs will, through recommendations made in the audit report, have a clear understanding of what improvements are required and agreed dates for their implementation through the action plan. This will also include when the audit team will carry out follow-ups to confirm the implementation of actions to address recommendations.

9. The CA (auditee) will be given the opportunity to provide feedback during and after every audit engagement. Feedback after an audit engagement will be recorded and independently reviewed. The feedback will be used to inform continuous improvement of the audit system.

1.5 References to regulatory frameworks, codes and guidance

1.5.1 In Northern Ireland, the power to set standards and monitor Enforcement Authorities’ food law enforcement services was conferred on the FSA under section 12 of the Food Standards Act 1999(^3) and Regulation 7 of the Official Feed and Food Controls (Northern Ireland) Regulations 2009(^4).

1.5.2 Audits are carried out against a range of criteria:

- NI food and feed regulations
- EU food and feed regulations
- Statutory codes of practice and practice guidance
- DAERA VPHP’s Manual of Official Controls(^5)
- The Framework Agreement on Official Feed and Food Controls by Local Authorities
- CA policies and procedures

Local Authorities / District Councils

1.5.3 The Framework Agreement on Local Authority (LA) Food Law Enforcement(^6) sets out the arrangements through which the FSA audits LA enforcement activities to help ensure that LAs are providing an effective service to protect public health

1.5.4 The overarching aims of the LA audit scheme are to:

- Help to protect public health by promoting effective local enforcement of food law
- Maintain and improve consumer confidence

______________________________________________________________________

(^3) Food Standards Act 1999 c.28 (^4) The Official Feed and Food Controls (Northern Ireland) Regulations 2009 (as amended) (^5) https://www.daera-ni.gov.uk/publications/manual-official-controls-vphp (^6) Chapter 5 of the Framework Agreement on Local Authority Food Law Enforcement: ‘Audit Scheme’ • Assist in the identification and dissemination of good practice to aid consistency • Provide information to aid the formulation of FSA policy • Promote conformance with the ‘Food Law Enforcement – Standard’ and any relevant central guidance or Codes of Practice • Provide a means to identify underperformance in LA food law enforcement • Promote self-regulation and peer review • Identify continuous improvement

1.5.5 A statutory code of practice is also in place which gives instructions that local authorities in NI must consider when enforcing food law. It relates to Northern Ireland only. There are also similar codes of practice in England and Wales.

1.5.6 The Food Law Code of Practice(^7) for NI is issued under Article 39 of The Food Safety (Northern Ireland) Order 1991(^8) (the Order), regulation 22 of The Food Hygiene Regulations (Northern Ireland) 2006(^9), which empower the Department of Health, Social Services and Public Safety (DHSSPS) to issue codes of practice concerning the execution and enforcement of that legislation by competent authorities.

DAERA

1.5.7 DAERA is a NI central government department whose responsibilities include delivering official controls on behalf of the FSA in the areas of meat, dairy, egg and primary production hygiene. A Service Level Agreement (SLA) is in place to manage the delivery of these official controls.

1.5.8 The FSA currently audits official controls and activities delivered by DAERA, as defined in the FSA / DAERA SLA, against the relevant criteria stated in 1.5.2.

1.5.9 Whilst the policy for animal feedingstuffs rests with the FSA, DAERA is the competent authority for the enforcement and delivery of feed official controls in NI.

______________________________________________________________________

(^7) Food Law Code of Practice for Northern Ireland (^8) The Food Safety (Northern Ireland) Order 1991 (^9) The Food Hygiene Regulations (Northern Ireland) 2006 2.0 Managing the audit function

2.1 Document control

2.1.1 All documents\\textsuperscript{10} used in the FSA in NI audit system are identified with a unique reference and recorded on the FSA in NI Document Master list.

2.1.2 Each time a document is changed, the change is recorded in the FSA in NI Document Control Log. Changes to FSA in NI audit system documents can only be made by the FSA in NI Audit Manager.

2.1.3 All documents listed on the Document Master list are stored on the FSA’s document storage system (Wisdom).

2.2 Independence and independent scrutiny

2.2.1 The principles for independence and the principles and process for independent scrutiny are based on the National Audit System (NAS) Network\\textsuperscript{11} reference document – Independence and independent Scrutiny\\textsuperscript{12}.

Independence

2.2.2 The FSA in NI’s audit system demonstrate independence on four levels:

- Organisational – a clear mandate to conduct its audits
- Functional – provision of adequately resourced, suitably qualified staff
- Process – free from influence at all levels of the audit system
- Auditor - behave objectively, impartially, and declare a conflict of interest when appropriate

2.2.3 It is through the independent scrutiny process that the independence of the audit system is challenged and confirmed.

Independent scrutiny

2.2.4 The process for independent scrutiny is documented in Annexe B.

2.3 Risk based audit programme planning

\\textsuperscript{10} Examples of documents include - manuals, procedures, processes, checklists, forms.

\\textsuperscript{11} The NAS network is a network of officials (auditors) from national competent authorities, responsible for the performance of audits of official control systems as provided for by Article 4(6) of Regulation (EC) No 882/2004\\textsuperscript{1}. The networks meet regularly, under the chairmanship of, and facilitated by, SANTE F of the EC, to exchange experiences in implementing national audit systems on official control activities. During the course of these exchanges; discussions, workshops etc. good principles and practices are identified and agreed by the network.

\\textsuperscript{12} NAS Reference Document - Independence and Independent Scrutiny 2.3.1 The FSA in NI audit planning process is based on a risk prioritisation of an audit universe containing official controls, related control activities and other relevant areas.

2.3.2 The principles and process for risk-based audit programme planning is based on the NAS Network reference document – Risk Based Planning for Audits of Official Controls(^\\text{13}).

2.3.3 FSA in NI’s process for carrying out the annual audit planning can be found in Annexe C.

2.4 Auditor ethics and competency

2.4.1 All members of the audit team are civil servants and as such will uphold the Civil Service code(^\\text{14}).

Auditor ethics

2.4.2 The following are ethics(^\\text{15}) and behaviours which specifically apply to FSA in NI auditors:

| Ethics and behaviours | |-----------------------| | Integrity - auditors shall perform their work with honesty, diligence and responsibility. They shall not knowingly be party to any illegal activity or engage in acts that are discreditable to the FSA. | | Independence - auditors should be independent of the activities audited, wherever practicable and should in all cases act in a manner that is free from bias and conflict of interest. | | Objectivity - auditors shall not participate in any activity or relationship that may impair or be presumed to impair their unbiased assessment. They shall not accept anything that may impair or be presumed to impair their professional judgment. |

(^{13}) NAS Reference Document - Risk Based Planning for Audits of Official Controls

(^{14}) https://www.gov.uk/government/publications/civil-service-code/the-civil-service-code

(^{15}) Section 6: Code of Ethics of the Public Sector Internal Audit Standards was used to describe the ethics highlighted in point 2.4.2. Confidentiality - auditors shall be prudent in the use and protection of information acquired in the course of their duties. They shall not use information for any personal gain or in any manner that would be contrary to the law or detrimental to the legitimate and ethical objectives of the FSA.

Competency: Training and experience

2.4.3 Each auditor employed by the FSA in NI has a working knowledge of the Food and Feed Regulatory Framework in the UK. They must also have specific advanced auditor training which gives them an understanding of auditing management systems and systems auditing e.g. attended an ISO 9000 lead assessor training course.

2.4.4 Auditors demonstrate the generic knowledge and skills needed as an auditor, including, audit principles, procedures and techniques, management / organisational skills. This is achieved by being a member of an audit team under the supervision of the Audit Manager.

2.4.5 In principal, each auditor must complete at least one audit of an OC delivery system each year(^\\text{16}). Two auditor development meetings are held in quarter one and quarter three of each financial year;

2.4.6 Organised by the FSA in NI Audit Manager, development days are used to:

- Plan and progress of audit programmes
- Discuss new audit guidance / working papers
- Discuss changes in legislation, codes of practice and statutory guidance

2.4.7 As well as addressing auditor competency, development days are used to carry out the audit system management review.

Technical auditors and technical experts

2.4.8 The audit team comprises a full-time audit manager and part-time technical auditors selected from policy teams within the FSA or the FSA’s Audit and Assurance team.

2.4.9 Technical auditors, for the purposes of this audit manual, are trained auditors(^\\text{17}) with technical expertise in one or more areas of feed and food policy. Each team used for an audit must contain at least one technical auditor with the relevant technical experience applicable to the audit scope and criteria for each audit programme / engagement.

2.4.10 From time to time, technical experts are selected from within the FSA or externally to participate in an audit programme / engagement. This will usually

(^{16}) Fiscal year

(^{17}) As defined under the 'Competency: training and experience' section of this manual. happen when no suitable technical auditor can be provided to the audit team. Technical experts provide advice and opinions based on their expertise but are not considered auditors and do not perform the functions of an auditor during an audit programme / engagement.

2.5 Co-ordination with other audit systems

2.5.1 The audit team recognises there are other CAs within the UK who also perform the same function. The audit team is represented at collaborative working meetings with these CAs. These include:

- DAERA
- Food Standards Scotland (FSS)
- Department of Environment, Food & Rural Affairs (DEFRA)
- Animal and Plant Health Agency (APHA)
- Veterinary Medicines Directorate (VMD)
- Welsh Government
- Scottish Government

2.5.1. The audit team collaborates with the Food Safety Authority of Ireland (FSAI). This collaboration can involve the exchange of audit system information (audit programmes, policies and procedures) and joint audit programmes.

2.6 Complaints process

2.6.1 There is a process in place for resolving complaints made by CAs arising from the conduct of feed and food service audits undertaken by the FSA in NI. The lead auditor is required to explain the complaints process to the CA at both the opening and closing meetings of the audit engagement. The complaints process, which includes escalation of the complaint, is also described in the audit plan for each audit programme.

2.6.2 A CA is encouraged to raise any concerns with the lead auditor during the on-site audit or audit reality check visit with the aim of resolving any issue at the time.

2.6.3 If the issue cannot be resolved with the lead auditor, the CA is advised to contact the Head of Consumer Protection, FSA in NI.

2.6.4 If there is disagreement with the content of the draft report, the CA is advised to contact the Head of Consumer Protection.

2.6.5 If the head of Consumer Protection cannot resolve the issue to the satisfaction of the CA, the CA is advised to contact the FSA Director with responsibility for Northern Ireland.

2.6.6 If the FSA Director with responsibility for Northern Ireland cannot resolve the issue to the satisfaction of the CA, the CA is advised to contact the Chief Executive of the FSA / Board Member for NI. The Chief Executive of the FSA / Board Member for NI are the final arbiter for resolving complaints raised by CAs.

2.7 Customer satisfaction

2.7.1 A key component of the FSA in NI audit system is feedback from CAs. The process describes how CAs can provide feedback to FSA in NI on both the audit system and the conduct of the audit team.

2.7.2 At the opening and closing meeting of every on-site element of an audit, auditees are given the opportunity to provide feedback to the audit team either specifically about the conduct of the audit or the FSA’s activities in general.

2.7.3 A customer satisfaction / feedback questionnaire is provided, along with the final report, to the auditee. The auditee is asked to complete the questionnaire and return it to the Head of Consumer Protection who reviews the questionnaire for independent evaluation.

2.7.4 Results from customer satisfaction questionnaires are compiled and reported on as part of the audit system management review and independent scrutiny processes.

2.8 Continuous improvement and lean auditing

2.8.1 The audit team is committed improving processes within the audit system and to seek innovative ways to make the audit system more effective. It is also important to demonstrate the audit system is capable of adding value to both the CAs’ official control delivery systems and FSA policies and guidance.

2.8.2 The audit team uses continuous improvement and lean principles, tools and techniques to help achieve this.

Continuous Improvement

2.8.3 Continuous improvement techniques are applied to several processes in the FSA in NI audit system:

- Risk based audit planning
- Customer satisfaction / feedback
- Audit system management review
- Independent scrutiny

Lean Auditing

2.8.4 The audit team seeks to apply lean(^{18}) principles, tools and techniques to all processes in the audit system, for example:

(^{18}) [https://www.lean.org/WhatsLean/](https://www.lean.org/WhatsLean/) Table 3 – Lean principles applied to auditing

| The application of lean principles | |-----------------------------------| | Audit teams that are appropriately resourced – Use of trained auditors with the technical competency applicable to the audit scope and criteria, when available. This ensures targeted, effective and efficient use of auditor and technical resource. | | Communication must be clear and within agreed timescales – Communication, both written and verbal, with auditees before during and after audit engagements should be clear. It should be delivered in a format that avoids confusion and misinterpretation. It should also fulfil wider stakeholder expectations. | | The audit team should be open and transparent - The audit team should clearly communicate to the auditee and relevant stakeholders the following information before the commencement of an audit engagement: | | • the reasons for an audit programme | | • the scope and objectives of audit programme | | • reasons for auditee selection | | • the audit engagement process including reporting and follow-up | | This also includes providing the auditee with the audit documentation (e.g. audit plan, checklist, aide memoir) used by the audit team during and audit engagement. | | Audit outputs clearly linked to audit objectives - The audit team must be able to demonstrate added value and deliver auditee / customer expectations for each audit programme. To do this the auditee / wider stakeholders must be able to consider the audit outputs (findings, conclusions, reports, recommendations, good practice, wider dissemination of issues) and judge the audit to have been valuable and carried out to their satisfaction. Measured through the customer satisfaction and independent scrutiny processes. | | Selecting the most appropriate audit method – The audit team must be critical in their selection of the audit methods to use during an audit engagement. Using the same methods for all audit programmes is not an effective or efficient use of resource for both the audit team and the auditee. | Audit findings, reports and general communication are useful - Audit findings must be efficient, insightful and recognise the wider context of the challenges facing CAs. As well as confirming compliance with feed and food law auditors should add value to the auditee through recommendations which improve suitability and effectiveness as well as highlighting efficiencies to the CAs about their control systems.

Table 4 – Practical examples of lean

| Practical examples of the application of lean tools and techniques | |---------------------------------------------------------------| | Audit programme planning based on risk prioritisation not risk management – selection of OC or OC activities to be audited must be based solely on the impact element of a risk assessment(^{19}). Auditors are not responsible for risk management therefore it is wasteful for the auditors to consider likelihood. Likelihood is considered later, during the audit, because to assess likelihood you must include the current level of controls in place to management a risk. It also encourages less complex scoring processes which can also reduce the level of resource in the audit planning process. | | Obtaining information in a timely manner - Each audit assignment includes the use of a pre-visit questionnaire (PVQ) requesting information on policies, processes, procedures and specific OC activity data. The PVQ is completed and returned for analysis by the audit team before the on-site element of the audit. The audit team gain a greater understanding of the auditees resources, control systems, including allowing the selection of specific areas to target while on-site. Using this method also allows the auditor to ‘hit the ground running’ and avoids wasting time learning about the auditees controls systems at the start of the on-site element of the audit. | | Defining timelines and communication channels – It is important to agree and define how long an audit will take and who will be involved. It sets expectation levels and responsibilities focusing on delivering the audit on time and defining auditor and auditee responsibilities. For example, the timing of audits is defined in the annual list of audit programmes and in the audit plan for each audit programme. Timetables are used to show how long |

(^{19})As part of the risk management process risks are normally scored using the following formula. Risk = Impact x Likelihood. Auditors are not responsible for risk management. the on-site element will take. The roles of the auditors are set out in the opening meeting and an audit liaison officer\\textsuperscript{20} is identified by the auditee.

Direct access to information / data – the most efficient way to obtain and examine information / data is through direct access. This eliminates the need for the auditor to issue requests constantly and frees up the auditee to perform other duties. An indicator of a well performed audit is the level of impact / disruption caused to the auditee. A good example of this is auditors having direct access to CAs’ data management systems.

The use of Gemba\\textsuperscript{21} - In the context of auditing official control delivery systems, this is referred to as a reality check visit. These are carried out at the food/feed business operators’ premises. They are used to verify documented information recorded by the CA, allow officers delivering OCs to demonstrate their knowledge of FBO activities and confirm the comprehensiveness of OC delivery.

Root cause analysis (RCA) - Basic root cause analysis is practiced by the audit team when preparing recommendations. Auditees are also encouraged to use RCA when preparing actions to address recommendations.

2.9 Audit system management review

2.9.1 The objective of management review is to confirm the audit system remains suitable, adequate and effective. The review should:

- Consider if the audit system is functioning as planned
- Identify opportunities to improve
- Identify non-conformities and monitoring corrective and preventive actions.

2.9.2 The audit system management review is carried out twice a year at the same time as the auditor development day. It is carried out by the audit team and covers the topics listed in Annexe D.

2.9.3 A record of each review is stored on Wisdom\\textsuperscript{22}.

\\textsuperscript{20} The audit liaison officer is the person nominated by the auditee / CA to act as the main contact for the audit team to clarify information provided in the PVQ, request information through and provide regular feedback to during the on-site element of the audit.

\\textsuperscript{21} Gemba is the Japanese word for the real place (e.g. the place where a news event takes place). The lean technique is to ‘Go Look See’ what is really going on. In the context of auditing official control delivery systems, it is carried out at the food/feed business operators’ premises, as this is where OCs are delivered.

\\textsuperscript{22} Wisdom is the FSA’s document storage system. 3.0 The audit engagement process

3.1 Audit engagement planning

Audit plan: scope, objectives and criteria

3.1.1 An audit plan must be produced for each audit programme. It should contain the following headings:

- Introduction (including reasons for the audit programme)
- Scope, objective(s), and criteria
- Notification arrangements
- Documents used
- Audit engagement process (including reporting & follow-up)
- Feedback
- Publication of reports
- Complaints & disputes

3.1.2 The audit plan must be agreed and distributed to auditee(s) before the commencement of the audit programme.

Audit team

3.1.3 The lead auditor(^{23}) is responsible for selecting each audit programme / engagement audit team. The selection of auditors will be primarily based on availability of auditor(s) with the specific technical experience which matches the audit scope and criteria. Availability of all FSA in NI auditors to perform the audits within the time period detailed in the FSA in NI’s annual list of audit programmes is also a factor in selecting the audit team for each audit programme / engagement.

Types of audits

3.1.4 Selecting which type of audit to use during an audit engagement is an important decision as it will determine the amount of audit resources required. It can lead to wasted resource both in terms of the audit team and CA. The types of audits used by FSA in NI include:

- Full audits – covering all sections of the Framework Agreement or the full range of OC activities of a CA.
- Focused audits – can be based on Regulations, one or more areas of the framework agreement, feed or food law codes of practice or practice guidance, DAERA’s Manual of Official Control (MOC).

Audit methods

(^{23}) The FSA in NI audit manager is currently the lead auditor for all audits carried out in NI. 3.1.5 This is another important decision to make at the planning stage. Selecting which method or combination of methods to use during an audit can have a major influence on the level of added value to the CA and the usefulness of evidence is collected. The range of methods used by FSA in NI include:

- Desktop assessment – e.g. PVQ information, FSA data (LAEMS, FHRS, FSA-DAERA Service Level Agreement (SLA data), published data (LA service plans and enforcement policies)
- Documentation checks – e.g. records of interventions (audits, inspections, sampling, follow-ups, complaint investigations), formal enforcement notices, management records (training and competency evaluation, internal monitoring, delegated authority, authorisations, service delivery monitoring records)
- Interviews – e.g. managers, officers, FBOs, policy leads
- Reality check visits – i.e. visits to FBOs establishments

Audit Evidence

3.1.6 The principles, definitions and methods used in the FSA in NI audit system around audit evidence is based on the NAS Network reference document – Audit Evidence(^\\text{24}).

3.1.7 Consideration about what evidence should be collected and how it is to be collected must start at the planning stage of an audit programme. It is important to focus resources on gather evidence which supports findings associated to the audit scope and objectives.

3.1.8 There will also be occasions when evidence is found identifying issues which are outside the audit scope and objectives. This evidence should be used by the lead auditor to investigate issues further, as appropriate, but not as part of the audit engagement where the evidence was found.

3.2 Conducting the audit engagement

Audit team responsibilities

3.2.1 The FSA in NI audit manager acts as lead auditor for all audit engagements. The audit manager is responsible for:

- Preparing the working documents for each audit engagement
- chairing the opening and closing meetings
- drafting the audit report (including recommendations)
- performing the follow-up to gather evidence to address recommendations

3.2.2 At least one member of the audit team will be identified as the auditor with technical expertise relevant to the audit scope and criteria. It is their

(^{24}) NAS Network reference document – Audit Evidence responsibility to provide clarifications and direction regarding technical and regulatory issues during the audit.

3.2.3 The role of each member of the audit team are agreed once the PVQ has been returned by the CA and before the on-site element of the audit begins.

Working documents

3.2.4 The audit team will prepare and use a number of documents during the audit engagement to gather information from the auditee, record evidence and provide information to the auditee.

3.2.5 As a minimum the following documents will be used:

- PVQ
- Request for specific officer and establishment records
- On-site audit timetable
- Opening meeting lead auditor notes
- Closing meeting lead auditor notes
- Checklist / aide-mémoire

Opening and closing meetings

3.2.6 Clear communication and understanding between the auditors and auditee is important to ensure the audit is conducted to auditee’s satisfaction. It aids auditee’s understanding of the audit findings, leading to better implementation of actions to address recommendations.

3.2.7 Two formal meetings are always planned for each audit, an opening meeting and closing meeting:

- Opening meeting – used to formally affirm the details of the audit plan (audit scope, objectives, criteria), practical process for the on-site element of the audit, complaints, reporting and follow-up procedure.
- Closing meeting – used to present the audit findings, explain the process required after the on-site element has finished, re-affirm the complaints, reporting and follow-up processes.

Checklists and aide memoires

3.2.8 Both checklist(s) and/or aide-mémoire(s) can be used during audits to list specific questions / areas to cover during the audit. They are also one of the methods used to record evidence.

3.2.9 It is at the discretion of the audit manager, during the audit planning stage, to decide the content of any checklist(s) and/or aide-mémoire(s) used. A library of previous checklist(s) and/or aide-mémoire(s) can be found on Wisdom.

Auditor notes 3.2.10 Checklists and aide-mémoires can be supplemented by notes taken by the auditors. These are valid methods for recording evidence, providing feedback to the auditee, forming the basis of audit findings, and conclusions.

Audit findings

3.2.11 Audit findings are based on evidence collected during the audit. Checklist(s), aide-mémoire(s) and auditors’ notes are used to record evidence. Audit findings can also be based on evidence collected during the audit from the auditee or from other relevant sources such as publications, reports and data.

3.3 Audit reporting

3.3.1 Each audit plan will describe how the audit programme will be reported. The reporting for an audit programme can range from one audit report to multiple audit reports and a summary report.

3.3.2 The most common way to report an audit programme is to have an audit report for each CA in the audit programme. If more than one CA is included in an audit programme, then a summary report is usually produced once all the individual audit reports have been issued.

3.3.3 The timing for drafting and issuing reports is set out in the table below.

| Report Phase | Time | |-------------------------------|------------------------------------------------| | Draft report | Issued within 20 workings days of the audit closing meeting | | Auditee comments on draft report | Within 20 working days of receiving the draft report | | Issue of report | Within 15 days of receiving auditee response |

Individual reports

3.3.4 When an individual audit report is produced it will usually have content under the following headings:

- Introduction
- Background
- Reason for audit
- Scope and objectives of the audit programme
- Audit criteria • Executive summary • Audit opinion • Audit findings • Action plan (including recommendations) • Glossary

3.3.5 There is an expectation DC audit reports will be placed in the public domain. Audit reports will be issued to councils with the expectation that the reports will be presented to elected members within the appropriate local public forum. Copies of final audit reports will be placed on the Food Standards Agency website.

3.3.6 Currently audits of DAERA are not placed in the public domain.

Summary reports 3.3.7 Summary reports are used to: • Provide an overview of how the audit programme was carried out • Summarise the findings from all the audits • Present good practice found during audits • Identify and record recommendations for FSA policy

3.3.8 Summary reports will usually have content under the same headings as individual reports and will also include the following heading: • Conclusions • Summary of recommendations • Recommendations for FSA

Audit opinions and recommendations 3.3.9 Each audit report will contain an overall opinion from the auditors about the CA’s system for delivering official controls and official control activities covered by the scope of the audit.

3.3.10 The opinion will be taken from one of the four categories listed in the table 6 below. Before its introduction, these audit opinion categories will be subject to piloting in 2021.

Table 6 – Categories used for auditor opinion

| Audit Opinion | Definition | |---------------|------------| | Substantial | The sections of the Competent Authority’s system for delivering official controls and official control activities covered by the scope of this audit report demonstrate effective implementation of planned arrangements suitable to achieve the objectives of the relevant legal requirements and guidance. | The sections of the Competent Authority’s system for delivering official controls and official control activities covered by the scope of this audit report requires some improvement to fully demonstrate effective implementation of planned arrangements suitable to achieve the objectives of the relevant legal requirements and guidance.

The sections of the Competent Authority’s system for delivering official controls and official control activities covered by the scope of this audit report requires significant improvement to fully demonstrate effective implementation of planned arrangements suitable to achieve the objectives of the relevant legal requirements and guidance.

The sections of the Competent Authority’s system for delivering official controls and official control activities covered by the scope of this audit report requires substantial improvement to fully demonstrate effective implementation of planned arrangements suitable to achieve the objectives of legal requirements and guidance.

3.3.11 Recommendations are made by the auditors to aid improvements to the system or to record issues which require action. When recommendations are made, they are recorded in an action plan.

3.3.12 Action plans are used by the auditee to record actions / changes in policy, procedures, etc, to address recommendations. Action plans also include forecasted dates of when the auditee thinks the actions will be completed. These dates are agreed with the lead auditor.

3.3.13 Prioritising recommendations allows the auditee to appropriately allocate resources. It also allows the reader to clearly gauge the importance of the recommendation.

Table 7 – Priority rating for auditor recommendations

| Priority Rating | Definition | |-----------------|------------| | High | Should be implemented as soon as possible due to its potential or actual adverse impact on the system or process. | | Medium | The weaknesses identified are less likely to affect the achievement of the objectives of the system or process. They are important issues which should be addressed by management in their areas of responsibilities. | | Low | Minor weaknesses identified in the system or procedures that are unlikely to affect the achievement of the objectives of the system or process but wish to bring to the attention management to enhance risk management control. | Audit Action plans

3.3.14 When a recommendation is made it is recorded in the audit report and in an action plan. The action plan details:

1. The recommendation
2. Its priority rating
3. Actions to address the recommendation
4. Specific dates (month & year) for completing individual actions

3.3.15 The CA is responsible for providing the lead auditor with updates on progress with actions plans. The lead auditor is responsible for amending the action plan with these updates and for indicating on the action plan when actions to address recommendations are completed.

3.4 Audit follow up

Timing of follow-up

3.4.1 If there are no recommendations made, the process for drafting the audit report is followed and no follow-up is required.

3.4.2 If there is an action plan, as a rule the lead auditor contacts the CA for an update on progress six months from the date the audit report was issued.

3.4.3 At the discretion of the lead auditor and with the agreement of the CA, follow-up can take place as and when individual action due dates occur.

Evidence of implementation of actions

3.4.4 A CA must provide evidence of actions to address recommendations. The type and detail required must be confirmed and agreed with the lead auditor. Examples of the type of evidence accepted can include:

- Re-drafted scheme of delegation
- Authorisation
- Qualification / Training records
- Amendments to procedures / policies
- Intervention reports
- Samples results
- Meeting minutes Annexe A – FSA In NI Audit System Process

FSA in NI Audit System Process

- Audit Programme Planning

- Audit Preparation

- Audit Implementation

- Audit Reporting

- Audit Followup

- Audit System Management Review

- Co-ordination with other audit providers

- Risk Based Audit Programme Planning

- Auditor Resourcing

- Audit Working Papers

- Circulation and Transparency

- Customer Feedback

- Continuous Improvement & Lean Auditing

- Independent Scrutiny

NIAS-P-01 Rev. 1 Page 1 of 1 Annexe B – Independent Scrutiny

FSA in NI Independent Scrutiny Process

- Risk Based Audit programme Planning

- Draft annual programme of audits

- NI SLT / ARAC scrutiny of audit programme

- Agree annual audit programmes

- Annual programme of audits

- Quarterly progress reports

- Satisfactory progress

- Annual report to SLT / ARAC

- Audit Prog Summary Reports

- FSA policy recommendations

NI SLT / ARAC contact FSA policy

No - amend

Yes Annexe C – Risk Based Audit Planning

Annual Risk Based Audit Programme Planning

**RESPONSIBILITY / INPUT**

- Carried out by Policy Leads

  - Supported by Audit Teams

- Issued by Audit Team

- Carried out by Policy Leads

  - Supported by Audit Teams

- Issued by Audit Team

- Prepared by Audit Teams

  - Agreed by NI SLT / ARAC

- Agreed by NI SLT / ARAC

  - Issued by Audit Teams

**TIMELINE**

- QTR 3

  - Sept
  - Oct
  - Nov

- QTR 4

  - Jan
  - Mar

- Define / Review Official Control Risk Universe

- Official Control Risk Universe

- Risk Assessment & Prioritisation

- Prioritised Official Control Risk Universe

- Draft Annual Audit Programme

- Annual Plan of Audit Programme(s) Annexe D – Audit System Management Review Process

1. An agenda for each management review should be produced by the audit manager.
2. Minutes of each review should be made and stored on Wisdom. The minutes should also include a summary of the discussions on each topic listed in the table 8.
3. The evidence listed in table 9 should be prepared and presented by the audit manager at each review.

Table 8 - Topics / areas to be discussed during each management review

| Topic / area: | |---------------| | • Adequacy of audit system documentation (e.g. policies, processes and procedures) | | • Discussion on the status of any issues or outstanding actions from the previous meeting | | • External and internal issues affecting the audit system | | • Review of available resources and their adequacy | | • Review of previous actions taken to improve the audit system identified | | • Identification of further opportunities for improvement |

Table 9 – Evidence required for each audit system management review

| Evidence for an audit system management review: | |-----------------------------------------------| | • Minutes of previous management review meeting | | • Audit system documentation. | | • NI and other relevant audit reports. | | • Customer satisfaction questionnaires. | | • Complaints since the last review. | | • Corrective and preventive actions including follow-up and close-out of Management Information Reports. | Annexe E – Example Of Audit Opinion

Audit Opinion for XXXXXX

Moderate Assurance: the system for delivering official controls requires some improvement to fully demonstrate effective implementation of planned arrangements suitable to achieve the objectives of legal requirements and guidance.

## Annexe F – Glossary

| Name | Description | |-------------------------------------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | Audit | A systematic and independent examination to determine whether activities and related results comply with planned arrangements and whether these arrangements are implemented effectively and are suitable to achieve objectives. | | Authorised Officer | A suitably qualified officer who is authorised by the Local Authority to act on its behalf in, for example, the enforcement of legislation. | | Competent Authority (CA) | The authority responsible for the organisation / delivery of official controls and of other official activities. | | Environmental Health Officer (EHO) | Officer employed by the local authority to enforce food safety legislation. | | Food Business Operator (FBO) | This refers to the natural or legal persons responsible for ensuring that the requirements of food law are met within the food business under their control. | | Food hygiene | The legal requirements covering the safety and wholesomeness of food. | | Food Law Code of Practice (Northern Ireland) February 2016 (FLCoP) | Article 39 of the Food Safety (NI) Order 1991 (the Order), Regulation 22 of the Food Hygiene Regulations (NI) 2006 and Regulation 6 of the Official Feed and Food Controls Regulations (NI) 2009, which empower the Department of Health Social Services and Public Safety to issue codes of practice concerning the execution and enforcement of that legislation by district councils. This code is issued as guidance to competent authorities on the enforcement of food legislation. It relates to Northern Ireland only. | | Food Standards Agency (FSA) | The Food Standards Agency is an independent Government department set up by an Act of Parliament in 2000 to protect the public's health and consumer interests in relation to food. Everything we do reflects our vision of Safe Food and Healthy Eating for all. | | Framework Agreement | The Framework Agreement consists of: Chapter One Service Planning Guidance Chapter Two The Standard Chapter Three Monitoring of Local Authorities Chapter Four Audit Scheme for Local Authorities | | **Local Authority (LA) / District Council (DC)** | An organisation that is officially responsible for public services and facilities in a particular area. | | **Food Law Practice Guidance (Northern Ireland) October 2016 (FLPG)** | Guidance issued by the Food Standards Agency to assist district councils with the discharge of their statutory duty to enforce the Food Safety (NI) Order 1991, Regulations made under it, and food law made under the European Communities Act 1972. | | **Manual of Official Control (MOC)** | The Department of Agriculture, Environment and Rural Affairs (DAERA) Veterinary Public Health Programme (VPHP) Manual for Official Controls (MOC) explains the tasks, responsibilities and duties VPHP officers undertake in approved establishments supervised by the VPHP. | | **Pre-visit Questionnaire (PVQ)** | Used by auditors to request information prior to an *audit visit*, to maximise the effectiveness of the time spent with a local authority. | | **Service Level Agreement (SLA)** | An agreement negotiated between two parties where one is the customer and the other the service provider. The SLA records a common understanding about services, priorities, responsibilities. For this audit manual the SLA between FSA and DAERA. | | **Service Plan** | A document produced by a Local Authority setting out their plans on providing and delivering a food service to the local community. |